Can I Sign Iowa Banking PDF

Can i industry sign banking iowa pdf safe

hi everyone I am Amira Mussina jebel from Iowa State University today I will present an empirical study on the current practices of changing secured software as an introduction secure software is a software that's been verified as secure at this certain time this this secure software may undergo change and the common purposes of changing software are treated is the new features fixing to existing effects improve maintainability or improving the performance of the software itself however this change may invalidate or break the security mechanism of this software so the goal of our study is we want to know what the practitioners do when performing change on the secure software in other words we want to know what they do to maintain the security mechanism of the software you we had three Memphis's in the study the first phase is study preparation in this phase we start with developing interview questions we developed the interview questions through several meetings and we also construct interview protocol using Turner's guidelines where the questions are formulated based on the research goal and information from informal discussion with the project sponsor the questions are then revised based on the feedback and we prepared open-ended questions to get detailed responses then we invite the interviewees and 11 of them agreed to participate in the study we had three participants from software engineering three participants from control system two participants from banking system two participants from security consultation and what by discipline from education system the second phase is data collection this phase start with conducting the interviews the interviews were conducted in one hour to resume because of the locations of the interviewees and the authors that conducted the interview they were conducted by two authors and at the beginning we explained the goal of the project and process to the interviewees and we also requested that person to record the interview then we transcribe the interview using transcribe we do this for all the set of the interviews the third phase is data analysis we start recording the interview using thematic analysis where the input for this process is the transcripts and the output are before they identify all the aspects as an example if in the transcript the participant mentioned they are concerned mostly on the of's top ten threats such as SQL injection we will put this as a web stop 10 then we group the similar thoughts to form teams here we merge code they are semantically similar across the transcript the last step is to analyze the data we identify the relationship among food and also challenges they are faced by the interviewees from recording steps we have 10 plug groups as the output the first group is software type the second group is security expect and concern the third group is security training the fourth group is security assessment activities the fifth group is secure development process the sixth group is called change process the seven group is technique secure change process the eighth group is tools the nine group is process participants and the last group is participants rules each of this code will be described in detail later we start with the software type they are developed by the participants as we can see from the chart we have eight types of software with web applications are developed mostly by the participants while api's and desktop applications at least for programming language there are eight types of languages used to develop the software with Java and JavaScript are mostly used while Python C and go are delicious you next we identified six security aspect and concerns that the participants concerned about condition secure software for participants consent of authentication and authorization and three of them said there will not deploy the stuff we're headed for the first release or subsequent release before making sure this aspect works perfectly for participants consent of olaf's top ten three participants consent of dependency vulnerabilities this became their concern since software is composed of set of components and these components can be developed internal or accent variants include vulnerabilities that impact security of the software to consent of access control and one participant consent of buffalo flu he mostly consent of buffer overflows since he writes software using non memory safe language scene and one participant constant of encryption where he mostly developed software that stores and manage encrypted data although repellency vulnerabilities and authentication and authorization are identified them separately as the participant specified them separate four participants reported they have or had formal training and the purpose of this training is to prepare the people before they involved in the process participant b1 have a lab stopped and security training participant b2 has static analysis security testing tool 20 participant p7 has strengthened a tailored to each role such as security code extended training for developers and participant b9 has training on development process and rules to ensure delivery of secure software developing secure software I require integration of security activities into the development process this included security coding standard security testing standards security assessment standards and rules for deploying application we focus here in the security assessment activities we identified six activities performed by the participants to assess the security of the software the first activity is an efficient testing that is performed by eight participants the second activity is static application security testing that is also performed by eight participants here participant people perform this activity at the development phase so that they can identify Bernal ability at early phase the connectivity is dynamic application security testing that is performed by five participants the full activity is called review that is performed by four participants for that review participant p7 perform for review from the start throughout the development process while participant physics perform peer review at the end of each release the fifth activity is software composition analysis that is performed by four participants and one participant will form object for analysis what chance' process is the activities of changing the code from request to the deployment we identified nine participants before this process except two participants that work on safety-critical system where change being start from scratch we develop a generate process that is based on our understanding from the information that we get from the interview here is how the process looks like first chain request will be sent or initiate getting the chain request risk assessment is performed followed by the change of port by the developers the change port then will be tested and only if the test is successful change code is deployed if it does fail the developers will fix the code and tested put in this cycle will be continuously happen until all the tests are successful assessing the security of the software after the code change identified four techniques performed by the practitioners several participants perform code review and three of their body review the pieces of change book since it impossible to review the whole foot base participants v9 stated having checked this of two and done helping performing code review however the problem if what review are it's labor extensive expensive and take a long time to complete the second technique is good analysis by participants perform static addresses security testing and dynamic analysis security 50 on the software exchange three participants perform functional testing and penetration testing on the modified software a discipline v9u stereo development process and performing all unit tests integration tests in addition of penetration testing while for participant fee to the risk of what change is assessed and a project manager will decide whether to perform the penetration testing only change code or not based on the assessment the least use is keyword search which is a technique developed internally by participant pyramid organization the technique is used to detect change that require code review by security expert he went that need to be track is specified in configuration files of tool and the tool will then scan the sauce port of human software and identify security deliver to change we identified 19 tools that are used by the participants for analysis and testing 10 tools are used for static analysis trade tools are used for web application security testing one tool is used for security testing component analysis vulnerability analysis penetration testing JavaScript testing and requirements understanding respectively shown in this slide is an example of the tool for each musician you next you identified eight participants involved in the process they are developer security team architect quality assurance risk manager development manager project manager and audit team among all the participants reserved for security tip is unexpected because only five participants mentioned the security team involved in the process well respect all eleven participant will have security people since we are talking about secure change after identify all the teams or foot group will identify or analyze the relationship among the team based on the information in the transcription as an example use is the relation between secure development and secure assessment activities we identify use ester relation pronged attacks that mentioned have secure development process and part of the process is performing code analysis as the assessment activities here are the detailed relationship among the teams security velopment process includes secure chain sub process that use techniques prosecutor change secure development process also use security assessment activities and is commonly used assess several application types such as web application and mobile application security element process usually focus in the security aspect data points and off people participating in the process assume specific roles and may have appropriate training that is developed based on the security aspect and concern to the organization's some participants use set of tools to assess the security of the process lastly assessment activities and the techniques for both process and sub process verify that expect and concern are addresses you although there are standard process or assessment activities that help in developing secure software there are several challenges they are faced by the practitioners the first challenge is diversity of the security issues where there are no one solution that can fix all these issues in other words there are no silver bullet solution that exists hence it is advisable to have as many layers of assessment activities as possible second challenge is the effectiveness of security assuring tools as an example static code analysis have a very high rate of false positive developers who spend most of their time to filter the issues which made it motivate them since sometimes they cannot found the real issues at all the third challenge is ignoring human factor organizations tend to focus on the technical aspects while ignoring human factors such as the emotion of the employees remember that developing secure software requires collaboration of people involved in the process hence effective communication is very essential to the success of this process we conclude that there are six security aspects that the practitioners look for when changing secure software and these aspects are NFC vulnerability authentication and authorization access control all have stopped and encryptions and buffer overflow we also feel good that there are three challenges that the practitioners face when changing secure software that are diversity of security issue effectiveness of security assurance tools and ignoring human factor however we do not find a stop method of assessment of the security of change this end my presentation thank you for watching and listening